Greetings

As is sometimes the case, I have been asked to provide an unsecured MCUBoot build and a Secure MCUBoot build.
By unsecured, I mean using the default key whereas the secured version used their generated key. Mine is not to reason why so I won’t get into that 🙂

I have no issues with accomplishing what they’ve asked for, however, I know there will be questions like, “How do I know it worked?”.

In my testing, I assumed that MCUBoot wouldn’t even try to load it. That assumption appears to be incorrect and it actually does the process and falls back to the original secured image upon reboot. I can tell because the two builds are using different BLE names. So the unsecured build is definitely not loaded.

This method of testing was only for my own peace of mind and their builds will not do that so how can I assure them this is the case? Any ideas, since NRF Connect for iOS does not seem to care about the keys?

Any ideas much appreciated.

If you try to transfer an imaged signed with the wrong key it should reject it. That’s irrespective of how it was done (over UART, BLE, etc)

Then that begs the question, why did NRF Connect transfer the image and seemingly do the update process as indicated by progress percentages?

This project is using NCS 2.3.0

Nordics MCUBoot page has a section about incorporating the public key into code. I am assuming I don’t need to do that because none of the mcuboot videos and examples I have seen do that step, including yours. It’s just a matter of setting
these configs and the build process handles the rest.

CONFIG_BOOT_SIGNATURE_TYPE_RSA=y
CONFIG_BOOT_SIGNATURE_KEY_FILE=“c:/ncs/keys/name-rsa-2048.pem”

I am also assuming the app_update.bin that gets placed into dfu_application.zip is in fact the signed bin file?

That must be the case considering this build output:

[547/555] Generating zephyr/mcuboot_primary_app.hex
[548/555] Generating zephyr/mcuboot_primary.hex
[549/555] Generating ../../zephyr/app_signed.hex
sign the payload
[550/555] Generating ../../zephyr/app_update.bin
sign the payload
[551/555] Generating ../../zephyr/dfu_application.zip
[552/555] Generating ../../zephyr/app_test_update.hex
sign the payload
[553/555] Generating ../../zephyr/app_moved_test_update.hex
[554/555] Generating zephyr/merged.hex
[555/555] Generating zephyr/merged_domains.hex

For Vanilla Zephyr you have to explicitly sign it I believe. For NCS it’s done automagically for you.

Terms and Conditions | Privacy Policy